1. Field of the Invention
The present invention is related to development of Web-sites and Web-applications. More specifically, the present invention relates to secure binding of client calls to the server.
2. Description of the Related Art
The online experience of Internet users is important to Web-site owners. Internet users expect Web-sites and Web-based applications to work properly, to be highly responsive, and to load quickly in the user's browser. Slow responding Web-pages often lead to searching for other Web-sites that are faster, more responsive and work correctly.
Prior to Rich Internet Applications, traditional Web applications involved a client-server architecture with all of the processing on the server side and the client-side used to display the HTML web-pages served by the server. Each time a user desired to view a new Web-page, a HTTP request was sent to the server and the requested Web-page was served to the Web browser on the client-side. Such a traditional system is shown in FIG. 1 with a Web-server 1000 on a server side receiving requests over the Internet 1005 from a Web-browser 1003 on a client-side.
Rich Internet Applications, such as Ajax, greatly improved on the traditional client-server architecture by allowing the client machine to dynamically render and partially refresh web pages based on an initial set of instructions from the server, user input, and small amounts of subsequent data dynamically requested from the server. As shown in FIG. 2, the client machine processes Ajax instructions to render a Web page for the user.
Early Web applications allowed a user's browser to send a request to a server. The server processed the request and responded to the browser with a Web page. When the user wanted to view a new page, another request was sent to the server and the server responded to the browser with a new Web page. Such a process resulted in a waste of bandwidth since much of the Web contents in the first Web page were also contained in the second web page. The need to resend the same information led to a much slower user interface of a Web application than that of a native application.
An emerging technology, called Ajax (Asynchronous and JavaScript XML), was developed for refreshing part of a page instead of refreshing the whole page on every interaction between the user and application. In an Ajax application, when a user submits a form in a page, a script program, usually a JavaScript program, resident on the Web browser receives the user's request and sends a XML (Extended Markup Language) HTTP (Hyper Text Transfer Protocol) request to the Web server in background so as to retrieve only the needed Web contents instead of the whole page and perform corresponding processing to partly refresh the page when receiving a response from the Web server. In this way, the application response time is shortened, because the amount of data exchanged between the Web browser and the Web server is greatly reduced. And the processing time of the Web server is saved because much of the processing is performed at the client side.
General definitions for terms utilized in the pertinent art are set forth below.
Ajax is the use of dynamic HTML, JavaScript and CSS to create dynamic and usually interactive Web sites and applications. A more detailed explanation of Ajax is set forth in Edmond Woychowsky, AJAX, Creating Web Pages with Asynchronous JavaScript and XML, Prentice Hall, 2007, which is hereby incorporated by reference in its entirety.
Applets or Java Applets are mini-executable programs named with the .class suffix and are placed on a Web page and provide interactive and multimedia uses.
Application Programming Interface (API) is a collection of computer software code, usually a set of class definitions, that can perform a set of related complex tasks, but has a limited set of controls that may be manipulated by other software-code entities. The set of controls is deliberately limited for the sake of clarity and ease of use, so that programmers do not have to work with the detail contained within the given API itself.
An Attribute provides additional information about an element, object or file. In a Document Object Model, an attribute, or attribute node, is contained within an element node.
Behavioral layer is the top layer and is the scripting and programming that adds interactivity and dynamic effects to a site.
Binding in a general sense is the linking of a library to an application program usually to prevent repetition of frequently utilized code.
Cascading Style Sheets (CSS) is a W3C standard for defining the presentation of Web documents.
Compiler is a computer program that translates a series of instructions written in one computer language into a resulting output in a different computer language.
Document Object Model (DOM) Element is an object contained in a Document Object Model (DOM). The term DOM is generally used to refer to the particular DOM held in the memory region being used by the Web browser. Such a DOM controls the Graphical Respondent Interface (GRI) or Graphical User Interface (GUI). The DOM is generated according to the information that the Web browser reads from the HTML file, and/or from direct JavaScript software instructions. Generally, there exists a unique DOM element for every unique HTML element. DOM elements are sometimes referred to as HTML/DOM elements, because the DOM element exists only because HTML code that was read by the Web browser listed some HTML element that had not previously existed, and thereby caused the Web browser to create that DOM element. Often specific elements of the greater set of HTML/DOM elements are identified by specifying an HTML/DOM checkbox element, or an HTML/DOM text input element. A more detailed explanation of the document object model is set forth in Jeremy Keith, DOM Scripting, Web Design with JavaScript and the Document Object Model, friendsof, 2005, which is hereby incorporated by reference in its entirety.
HyperText Markup Language (HTML) is a method of mixing text and other content with layout and appearance commands in a text file, so that a browser can generate a displayed image from the file.
Hypertext Transfer Protocol (HTTP) is a set of conventions for controlling the transfer of information via the Internet from a Web server computer to a client computer, and also from a client computer to a Web server.
Internet is the worldwide, decentralized totality of server computers and data-transmission paths which can supply information to a connected and browser-equipped client computer, and can receive and forward information entered from the client computer.
JavaScript is an object-based programming language. JavaScript is an interpreted language, not a compiled language. JavaScript is generally designed for writing software routines that operate within a client computer on the Internet. Generally, the software routines are downloaded to the client computer at the beginning of the interactive session, if they are not already cached on the client computer. JavaScript is discussed in greater detail below.
JSON is JavaScript Object Notation format, which is a way of taking data and turning it into valid JavaScript syntax for reconstituting an object at the other end of the transmission protocol.
MySQL is a relational database management system which relies on SQL for processing data in a database.
Parser is a component of a compiler that analyzes a sequence of tokens to determine its grammatical structure with respect to a given formal grammar. Parsing transforms input text into a data structure, usually a tree, which is suitable for later processing and which captures the implied hierarchy of the input. XML Parsers ensure that an XML document follows the rules of XML markup syntax correctly.
PHP is a scripting language that allows developers create dynamically generated Web pages, and is used for server-side programming.
Platform is the combination of a computer's architecture, operating system, programming language (PHP, JAVA, RUBY ON RAILS), runtime libraries and GUIs.
Presentation layer follows the structural layer, and provides instructions on how the document should look on the screen, sound when read aloud or be formatted when it is printed.
Rendering engine is software used with a Web browser that takes Web content (HTML, XML, image files) and formatting information (CSS, XSL) and displays the formatted content on a screen.
Serialization places an object in a binary form for transmission across a network such as the Internet and deserialization involves extracting a data structure from a series of bytes.
SQL (Structured Query Language) is a computer language designed for data retrieval and data management in a database.
Structural layer of a Web page is the marked up document and foundation on which other layers may be applied.
User is a client computer, generally operated by a human being, but in some system contexts running an automated process not under full-time human control.
Web-Browser is a complex software program, resident in a client computer, that is capable of loading and displaying text and images and exhibiting behaviors as encoded in HTML (HyperText Markup Language) from the Internet, and also from the client computer's memory. Major browsers include MICROSOFT INTERNET EXPLORER, NETSCAPE, APPLE SAFARI, MOZILLA FIREFOX, and OPERA.
Web-Server is a computer able to simultaneously manage many Internet information-exchange processes at the same time. Normally, server computers are more powerful than client computers, and are administratively and/or geographically centralized. An interactive-form information-collection process generally is controlled from a server computer, to which the sponsor of the process has access. Servers usually contain one or more processors (CPUs), memories, storage devices and network interface cards. Servers typically store the HTML documents and/or execute code that generates Web-pages that are sent to clients upon request. An interactive-form information-collection process generally is controlled from a server computer, to which the sponsor of the process has access.
World Wide Web Consortium (W3C) is an unofficial standards body which creates and oversees the development of web technologies and the application of those technologies.
XHTML (Extensible Hypertext Markup Language) is a language for describing the content of hypertext documents intended to be viewed or read in a browser.
XML (Extensible Markup Language) is a W3C standard for text document markup, and it is not a language but a set of rules for creating other markup languages.
There are three types of JavaScript: 1) Client-side JavaScript; 2) Server-side JavaScript; and 3) Core JavaScript. Client-side JavaScript is generally an extended version of JavaScript that enables the enhancement and manipulation of web pages and client browsers. Server-side JavaScript is an extended version of JavaScript that enables back-end access to databases, file systems, and servers. Core JavaScript is the base JavaScript.
Core JavaScript includes the following objects: array, date, math, number and string. Client-side JavaScript and Server-side JavaScript have additional objects and functions that are specific to client-side or server-side functionality. Generally, any JavaScript libraries (.js files) created in core JavaScript can be used on both the client and the server without changes. Client-side JavaScript is composed of a Core JavaScript and additional objects such as: document, form, frame and window. The objects in Client-side JavaScript enable manipulation of HTML documents (checking form fields, submitting forms, creating dynamic pages) and the browser (directing the browser to load other HTML pages, display messages). Server-side JavaScript is composed of Core JavaScript and additional objects and functions for accessing databases and file systems, and sending email. Server-side JavaScript enables Web developers to efficiently create database-driven web applications. Server-side JavaScript is generally used to create and customize server-based applications by scripting the interaction between objects. Client-side JavaScript may be served by any server but only displayed by JavaScript-enabled browsers. Server-side JavaScript must be served by a JavaScript-enabled server but can be displayed by any browser.
Dinovo United States Patent Publication Number 20020069255 for a Dynamic Content Delivery To Static Page In Non-Application Capable Environment discloses a system for incorporating dynamic content into a static page from a non-application capable server.
Mocket et al., United States Patent Publication Number 20010037359 for a System And Method For A Server-side Browser Including Markup Language Graphical User Interface, Dynamic Markup Language Rewriter Engine And Profile Engine describes a system and method for a server-side browser including markup language graphical user interface, dynamic markup language rewriter engine and profile engine. The system includes a user computer and a destination server computer separated by a server computer hosting a server-side browser (SSB). The SSB includes a markup language graphical user interface (MLGUI), a dynamic markup language rewriter engine (DMLRE) and a profiling engine (PE). The SSB may be configured as an intermediary infrastructure residing on the Internet providing customized information gathering for a user. The components of the SSB allow for controlling, brokering and distributing information more perfectly by controlling both browser functionality (on the client-side) and server functionality (on the destination site side) within a single point and without the necessity of incremental consents or integration of either side.
Lafer et al., U.S. Pat. No. 6,192,382, for Method And System For Web Site Construction Using HTML Fragment Caching discloses storing HTML fragments in a tag cache.
Buchthal et al., U.S. Pat. No. 7,308,648 for a Method, System, And Computer-Readable Medium For Filtering Harmful HTML In An Electronic Document, discloses parsing an HTML document into HTML elements and attributes and comparing these to a content library using a filter of an API to remove unknown HTML fragments.
Daugherty et al., United States Patent Publication Number 20020016828 for a Web Page Rendering Architecture discloses a system and method for caching function calls.
Lipton et al., United States Patent Publication Number 20070143672 for Partial Rendering Of Web Pages discloses updating a Web page without having to download the entire Web page, with some rendering instructions represented as HTML fragments.
Irassar et al., United States Patent Publication Number 20040250262, for Business To Business Event Communications discloses an event handling mechanism that allows communication of event information among providers and subscribers across a network using an event handling server.
Jennings et al., United States Patent Publication Number 20070073739 for a Data-Driven And Plug-In Defined Event Engine, discloses an event engine that enables application developers to define finite state machines for implementation via a data-driven approach using executable plug-ins.
Lindhorst et al., U.S. Pat. No. 6,981,215 for a System For Converting Event-Driven Code Into Serially Executed Code, discloses an event-driven server model that uses active server pages that appear to other files as objects with associated method and properties for developing Web pages.
Wilson, United States Patent Publication Number 20070240032, for a Method And System For Vertical Acquisition Of Data From HTML Tables discloses passing a HTML document's content from a table to a DOM interpreter and parsing selected data to a formatted data structure on a browser.
Monsour et al., United States Patent Publication Number 20050278641 for a JavaScript Calendar Application Delivered To A Web Browser, discloses a JavaScript application that generates HTML on-the-fly from within invisible frames and renders such HTML on a user's screen in visible frames.
Alderson, United States Patent Publication Number 20040201618 for Streaming Of Real-Time Data To A Browser discloses means for sending real-time data to a browser in batches at a predetermined time by storing data in a queue either on the browser or server.
Dillon et al., U.S. Pat. No. 7,389,330 for a System And Method For Pre-Fetching Content In A Proxy Architecture discloses a system that uses an upstream proxy server in communication over a WAN with a downstream proxy server that communicates with a browser, which allows for pre-fetching of objects by the upstream proxy server over the Internet from a Web-server.
McCollum et al., U.S. Pat. No. 7,269,636 for a Method And Code Module For Adding Function To A Web Page discloses a means for adding function to a Web page on Web browser.
Collins et al., United States Patent Publication Number 20070027768 for a System And Method For Collection Of Advertising Usage Information discloses a HTML tag that is operative to request an instrumentation script from a script server, with the instrumentation script being operative to collect visitor event information on a Web-site.
Mechkov et al., United States Patent Publication Number 20070214239 for a Dynamically Updated Web Page discloses updating less than an entire Web page using an active server page authored using ASP.NET.
Abe et al., United States Patent Publication Number 20040268303 for a System, Method, And Computer Program Product For Generating A Web Application With Dynamic Content discloses a technique to use objects and Web contents dynamically generated on a server to generate a Web application model to support a change of a system.
However, current technologies that operate Server-side JavaScript fail to offer complete interactions which are the hallmark of rich web sites and applications.
In order for client-side code to call server-side functions and services, those server-side functions and services must be exposed to the web. But that raises security and compliance issues: how do you protect them from unauthorized access and abuse? How do you monitor who accesses them? While multiple techniques exist to address these issues, such techniques are complicated.